Origin flip: the framed app, connections bridge, and vendored pin move to the service origin and stock v1.18.29 (the M3 cutover)

[aarontrowbridge]

Important

Problem — The framed app, the connections bridge, and the vendored binary pin still point at the fork lineage: the panel iframes the ENGINE origin (which only works while the vendored fork binary serves the amicode app at its root), the overlay's /amicode/* fetches ride the server origin, and the vendored pin still names the fork's v1.18.10 release instead of stock v1.18.29. The fork cannot retire until the panel frames the extension service and the pin flips.
Approach — Execute the M3 cutover the service was built for: every consumer of the engine-origin UI flips to the service origin (chat panel, deck panes, connections bridge), the service's parallel-run language retires, and the vendored binary pin flips to the stock canonical v1.18.29 release assets the overlay was re-based onto.
Scope — in: the consumer flip (panel + deck + bridge call sites); the vendored pin flip with any fixture/buildinfo re-records it demands; retiring the parallel-run comments; the end-to-end proof against stock. · out: the shelf/proxy itself (#822, prerequisite); the upstream Gemini fix (Aaron's call, separate); any new surface.

Acceptance Criteria

• The chat panel and every deck pane iframe the service origin (not the engine origin), bootstrapping with a credential the service accepts
• The overlay app works end-to-end framed from the service origin against the stock v1.18.29 engine: engine API + SSE through the proxy, /amicode/* surfaces (home cards, widgets, solver-mode toggle) from the service routes
• The connections bridge targets the service (its connections routes are native there) and the vendored terminal's service URL export remains the probe path
• The vendored binary pin names the stock canonical v1.18.29 release assets (sha-verified per the fetch path's discipline), and every pin-dependent record (contract fixtures, buildinfo, golden files) is re-recorded from it
• The parallel-run wiring language is retired honestly (the M3 cutover note lands where the "consumers stay on the fork" comments live)
• The full local gate is green: typecheck AND the extension suite (the known environmental set excluded is documented, not assumed)

Testing Decisions

The service harness from #822 carries the framed-path contract tests; the pin flip re-records through the existing fetch/fixture machinery (the re-base slice's re-record precedent, PR #797). The boot proof from #822 re-runs pointed at the stock engine — the flip's end-to-end evidence.

Key Decisions

• The pin flip is part of THIS slice (the flip without it is a no-op against the fork binary) but is the riskiest part: if fixture re-records reveal an unplanned base dependence, split it into its own follow-up PR rather than forcing it — honest sequencing over a bundled red.
• The solver-mode route parity gap was already closed (the route port + golden re-record landed); the flip has no known parity gaps left.

Constraints & Invariants

• Never merge non-green; the fork retires ONLY after this lands and CI proves the stock path — no early fork-side deletions.
• No new fork (harmoniqs/opencode) work; the fork PRs Bug dock: composer wedges when the server can't arm report-a-bug (staged-skill drift) #296/BUG: Model picker switch doesn't update the extension's tracked model; session started text-only breaks on image attach #298 stay held.

Prior Art

#822 (the shelf — prerequisite); the parallel-run service slice (#451 M1) and its wiring comments; the re-base leg (PR #797 + #801/#802/#803) that landed the overlay on canonical and named these two blockers; the phase-2 disposition (consumers flip "when the service URL is framed").

Source

Fork-retirement blocker #2 from the harness-agnostic campaign's loop 28d. Part of the fleet-amicissimo-forksplit synthesis campaign. Blocked by #822.

Notes

Label hitl — human merge gate. Worktree off origin/main; the shared checkout's branch is never touched.

[aarontrowbridge]

Design note from the #822 implementation (carried so the flip's implementer sees it): the app's iframe bootstrap credential carrier is ?auth_token= (the ENGINE's carrier, server_auth.ts), which the service does not parse — the service validates Basic only. So at cutover, a document GET carrying only ?auth_token= would 401 at the shelf. The zero-app-side-change contract holds for every post-load API call (engine token accepted on /amicode/* + proxied unchanged); the bootstrap is THIS slice's seam: either the panel's iframe URL carries a Basic-compatible credential, or the service learns to parse the engine's ?auth_token= carrier for document/static GETs (the framed path only). Decide in the slice's tdd; both are in-bound.